Scenario: You want to audit the activity in a mailbox. Auditing includes information on who does what in a mailbox.
Enable Auditing for a mailbox: Set-Mailbox -identity “Mailbox Name” -AuditEnabled $true
Search Audit Logs for a mailbox: Search-MailboxAuditLog -Identity “Mailbox Name” -showdetails
Disable Auditing for a mailbox: Set-Mailbox -identity “Mailbox Name” -AuditEnabled $false
By default, the audit logs are retained for 90 days and then purged. This can be controlled by the -AuditLogAgeLimit parameter. The logs are stored in the mailbox under the Audits Subfolder under the Recoverable Items Folder. The Recoverable Items Folder is a hidden folder.
Ex-Shell 